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A backtracking method, program and unit that involves a traceback 
computer program for tracking a denial-of-service attack on a victim machine, v, 
back toward the source of the denial-of service attack. The traceback program 
determines a set of routers that are upstream neighbors of v and determines 
which of those neighbors is the principal source of packets flowing to v. After 
determining the identity of the neighbor node, n, that is the principal source of 
packets flowing to v, the traceback program continues further upstream from n to 
determine the upstream neighbor of n that is the principal source of packets to v. 
After determining this upstream neighbor, the program continues further 
upstream until the source of the denial-of-service packets is determined. 



